     (websockets-client/send! websocket (encode error-msg))
     nil))
 
+(defn log-access
+  [lvl message-data]
+  (sl/maplog
+    [:puppetlabs.pcp.broker.pcp_access lvl]
+    message-data
+    "{accessoutcome} {remoteaddress} {commonname} {source} {messagetype} {messageid} {destination}"))
+
 ;; NB(ale): using (s/Maybe Websocket) in the signature for the sake of testing
 (s/defn process-message! :- (s/maybe Connection)
   "Deserialize, validate (authentication, authorization, and expiration), and

        (try+
          (case (validate-message broker capsule connection is-association-request)
            :to-be-ignored-during-association
            ;; TODO(ale): log access (PCP-385); doing nothing for now
            (do)
            :not-authenticated
            (let [not-authenticated-msg (i18n/trs "Message not authenticated")]
              (if is-association-request
                ;; send an unsuccessful associate_response and close the WebSocket
                (process-associate-request! broker capsule connection not-authenticated-msg)
                (send-error-message message not-authenticated-msg connection)))
            :not-authorized
            (let [not-authorized-msg (i18n/trs "Message not authorized")]
              (if is-association-request
                ;; send an unsuccessful associate_response and close the WebSocket
                (process-associate-request! broker capsule connection not-authorized-msg)

              nil)
            :to-be-processed
            (do
              (log-access :info (assoc message-data :accessoutcome "AUTHORIZATION_SUCCESS"))
              (let [uri (broker-uri broker)
                    capsule (capsule/add-hop capsule uri "accepted")]
                (if (= (:targets message) ["pcp:///server"])
